Computer Aided Fraud Prevention and Detection

A Step by Step Guide

David Coderre

• Publisher: Wiley
• Year: 2009
• Print ISBN: 9780470392430
• eBook ISBN: 9780470451618
• Edition: 1
• Topic: Business
• Subtopic: Auditing
• Index: Business

Praise for Computer-Aided Fraud

Prevention and Detection: A Step-by-Step Guide

"A wonderful desktop reference for anyone trying to move from traditional auditing to integrated auditing. The numerous case studies make it easy to understand and provide a how-to for those?seeking to implement automated tools including continuous assurance. Whether you are just starting down the path or well on your way, it is a valuable resource."
-Kate M. Head, CPA, CFE, CISA

Associate Director, Audit and Compliance

University of South Florida

"I have been fortunate enough to learn from Dave's work over the last fifteen years, and this publication is no exception. Using his twenty-plus years of experience, Dave walks through every aspect of detecting fraud with a computer from the genesis of the act to the mining of data for its traces and its ultimate detection. A complete text that first explains how one prevents and detects fraud regardless of technology and then shows how by automating such procedures, the examiners' powers become superhuman."
-Richard B. Lanza, President, Cash Recovery Partners, LLC

"Computer-Aided Fraud Prevention and Detection: A Step-by-Step Guide helps management and auditors answer T. S. Eliot's timeless question, 'Where is the knowledge lost in information?' Data analysis provides a means to mine the knowledge hidden in our information. Dave Coderre has long been a leader in educating auditors and others about Computer Assisted Audit Techniques. The book combines practical approaches with unique data analysis case examples that compel the readers to try the techniques themselves."
-Courtenay Thompson Jr.

Consultant, Courtenay Thompson & Associates

CHAPTER 1
What Is Fraud?

Why does someone become an auditor or fraud investigator?

What does an auditor or fraud investigator hope to accomplish for him- or herself and the organization?

For some, the notion of fraud, or at least the desire to prevent fraud, factored heavily in their decision to pursue the audit or fraud examiner profession. For others, the concept of fraud only became an issue when they started work and had to deal firsthand with fraud detection and prevention. Since the National Commission on Fraudulent Financial Reporting (known as the Treadway Commission) released its report in October 1987, fraud has been an increasingly important issue, particularly for members of the audit profession. The commission raised the issue of responsibility for the deterrence of fraud, and made it front page news. It also increased awareness in the business community of the prevalence of fraud and laid the groundwork for auditing standards and practices regarding fraud.

Starting in the late 1990s, there has been an even greater increase in the prominence of fraud detection. Further, courts have ruled heavily against internal and external audit companies and auditors who did not adequately address the detection of fraud or the protection of clients and stockholders from the negative effects of fraud. The large-scale problems at WorldCom and Enron have emphasized not only the importance of audit but also the devastating effects fraud can have on a company and its auditors. Accounting firms found themselves liable for millions of dollars and were forced to rethink the issue of fraud detection. In addition, governments have developed new rules and regulations to ensure accurate financial reporting, such as the Sarbanes-Oxley Act.

Fraud is not a rare occurrence or one that happens only in other companies. While the exact magnitude of losses to fraud is difficult to determine, in part because of undetected frauds, one study reported that most organizations lose between 0.5 and 2.0 percent of their revenues to fraudulent acts committed by their employees, vendors, and others. A survey by KPMG Forensic determined that employees were responsible for 60 percent of the losses.¹ A 1997 report by the Association of Certified Fraud Examiners places losses to fraud at 6 percent of gross revenue.² A 1997 study by Deloitte and Touche found that international fraud across the European Union costs members 60 billion euros a year.³ The PricewaterhouseCoopers 2003 Global Economic Crime Survey states that 37 percent of companies worldwide have suffered from a fraud in the last two years, with an average loss of $2 million.⁴

All of the studies seem to indicate that the cost of fraud has increased substantially over the past 10 to 15 years. The 2003 PricewaterhouseCoopers survey indicates that most companies expect fraud to increase in the next five years, with the greatest risk being theft of assets, followed closely by computer hacking, virus attacks, and theft of electronic data. Studies also show that fraud occurs in all types of industries and in both small and large firms.

Fraud is costly not only in dollars; it also can have serious nonfinancial effects. To make matters worse, fraud is not something that will go away on its own—it must be discovered and stopped or it will continue to grow. A fraudulent act committed by senior management may affect employee morale and stockholder confidence for many years. About half of the companies responding to the Global Economic Crime Survey felt that fraud had its biggest impact on employee motivation and morale. Companies were more concerned that fraud would affect their reputation and business relations than they were about the effect on share price.

What is fraud and why should auditors be concerned about its detection? Surely, this is a management issue; and while most auditors might like to “catch a thief,” it is often not their primary role or may not be their organizational role at all. Some organizations even have a separate fraud investigation group. Thus, in the current legal, business, and audit environments, many auditors and audit organizations remain confused about what fraud is, how it happens, who is responsible for its deterrence and detection, and what they should do to deter and detect it.

Auditors, fraud investigators, employees, and management all have roles to play in deterring and detecting fraud. Audit organizations should be well versed in the symptoms of fraud and the steps involved in its detection.

Audit management has an abiding responsibility to ensure that senior management has developed and implemented a corporate fraud policy that details the procedures that will be followed. Senior management is ultimately responsible for the effective and efficient operations of the business, including the protection of company assets and profits from theft and abuse. Management also should foster an atmosphere in which ethical behavior and mutual trust become the first line of defense against fraud. To be successful, antifraud initiatives must begin at the top, permeate all levels of the organization, and be actively documented, communicated, pursued, and enforced. When all players work together and are supported by well-thought-out corporate policies, fraud and its effects can be reduced and even prevented.

Fraud: A Definition

Fraud includes a wide variety of acts characterized by the intent to deceive or to obtain an unearned benefit. The American Institute of Chartered Public Accountants (AICPA) defines two basic categories of fraud: intentional misstatement of financial information, and misappropriation of assets (or theft). Other audit-related agencies provide additional insight into the definition of fraud that can be summarized in this way:

Fraud consists of an illegal act (the intentional wrongdoing), the concealment of this act (often only hidden via simple means), and the deriving of a benefit (converting the gains to cash or other valuable commodity).

The legal definition of fraud refers to cases where a person makes a material false statement—with the knowledge at the time that the statement was false; reliance by the victim on the false statement; and resulting damages to the victim. Legally, fraud can lead to a variety of criminal charges, including fraud, theft, embezzlement, and larceny. Each charge has its own specific legal definition and required criteria, and all of the charges can result in severe penalties and a criminal record.

The Report to the Nation on Occupational Fraud and Abuse⁵ divides occupational fraud into three major categories: misappropriation (accounting for 88.7 percent of the cases reported), corruption (27.4 percent), and fraudulent statements (10.3 percent).

The median losses reported by type of fraud ranged from $150,000 to over $2 million.

Fraud can be committed not only by an individual employee but also by a department, division, or branch within a company, or by outsiders. It can be directed against the organization as a whole or against parts of the organization. Also, it can be to the benefit of the organization as a whole, part of the organization, or an individual within or outside the organization.

Fraud designed to benefit the organization generally exploits an unfair or dishonest advantage that also may deceive an outside party. Even though it is committed to benefit the organization, perpetrators of such frauds often also benefit indirectly from the fraud. Usually personal benefit accrues when the organization is aided by the fraudulent act. Some examples include:

• Improper transfer pricing of goods exchanged between related entities by purposely structuring pricing to intentionally improve the operating results of an organization involved in the transaction to the detriment of the other organization
• Improper payments, such as bribes, kickbacks, and illegal political contributions or payoffs, to government officials, customers, or suppliers
• Intentional, improper related-party transactions in which one party receives some benefit not obtainable in an arm’s-length transaction
• Assignment of fictitious or misrepresented assets or sales
• Deliberate misrepresentation or valuation of transactions, assets, liabilities, or income
• Conducting business activities that violate government statutes, rules, regulations, or contracts
• Presenting an improved financial picture of the organization to outside parties by intentionally failing to record or disclose significant information
• Tax fraud

Fraud perpetrated to the detriment of the organization is generally for the direct or indirect benefit of an employee, outside individual, or another firm. Examples include:

• Misappropriation of money, property, or falsification of financial records to cover up the act, thus making detection difficult
• Intentional misrepresentation or concealment of events or data
• Submission of claims for services or goods not actually provided to the organization
• Acceptance of bribes or kickbacks
• Diversion of a potentially profitable transaction that would normally generate profits for the organization to an employee or outsider.

Why Fraud Happens

Given the risk involved, why do people commit fraud?

Indications from many studies, including interviews with persons who have committed fraud, are that most perpetrators of fraud did not initially set out to commit a crime. Generally, they simply availed themselves of an opportunity. The fraud triangle (see Exhibit 1.1) is used by experts in the psychology of fraud to explain the reasons for persons committing fraud. The fraud triangle consists of: opportunity, pressure, and rationalization.

EXHIBIT 1.1 The Fraud Triangle can be used to examine the causes of fraud.

The opportunity exists when there are weak controls a...

Table of contents

• Cover
• Contents
• Titlepage Text
• Copyright
• Dedication
• Case Studies
• Preface
• CHAPTER 1: What Is Fraud?
• CHAPTER 2: Fraud Prevention and Detection
• CHAPTER 3: Why Use Data Analysis to Detect Fraud?
• CHAPTER 4: Solving the Data Problem
• CHAPTER 5: Understanding the Data
• CHAPTER 6: Overview of the Data
• CHAPTER 7: Working with the Data
• CHAPTER 8: Analyzing Trends in the Data
• CHAPTER 9: Known Symptoms of Fraud
• CHAPTER 10: Unknown Symptoms of Fraud (Using Digital Analysis)
• CHAPTER 11: Automating the Detection Process
• CHAPTER 12: Verifying the Results
• APPENDIX A: Fraud Investigation Plans
• APPENDIX B: Application of CAATTs by Functional Area
• APPENDIX C: ACL Installation Process
• Epilogue
• References
• Index